From 64017e8ca6825b79a2acb887a1c1d9088e47ed72 Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Tue, 8 Nov 2022 11:38:42 +0100 Subject: [PATCH] Security: Omit error from http response when user does not exists (#639) --- pkg/api/password.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/api/password.go b/pkg/api/password.go index 8496c71b305..fe41c9ca5fa 100644 --- a/pkg/api/password.go +++ b/pkg/api/password.go @@ -28,8 +28,8 @@ func (hs *HTTPServer) SendResetPasswordEmail(c *models.ReqContext) response.Resp usr, err := hs.userService.GetByLogin(c.Req.Context(), &userQuery) if err != nil { - c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail) - return response.Error(http.StatusOK, "Email sent", err) + c.Logger.Info("Requested password reset for user that was not found", "user", userQuery.LoginOrEmail, "error", err) + return response.Error(http.StatusOK, "Email sent", nil) } if usr.IsDisabled {